A European customer or a privacy review put your data handling in question. This is the engineering side of it.
Privacy Act 1988 (Cth) Schedule 1, the thirteen Australian Privacy Principles, and Part IIIC, the Notifiable Data Breaches scheme. Where GDPR also applies, the equivalent obligations are handled alongside rather than instead.
| Reference | What it requires | What readiness produces |
|---|---|---|
| APP 1 | Open and transparent management of personal information | A privacy policy that matches what the system does. |
| APP 3 | Collection of solicited personal information | A data map showing what is collected and why. |
| APP 5 | Notification of the collection of personal information | Collection notices at the point of collection. |
| APP 6 | Use or disclosure of personal information | Purpose limits enforced in the system, not only in the policy. |
| APP 8 | Cross-border disclosure of personal information | Transfer mechanisms and residency decisions, recorded. |
| APP 11 | Security of personal information | Access control, retention and deletion that actually run. |
| APP 12 | Access to personal information | A subject access process with a timeframe. |
| APP 13 | Correction of personal information | Correction that propagates beyond the primary database. |
| Reference | What it requires | What readiness produces |
|---|---|---|
| Part IIIC | Notifiable Data Breaches scheme | An assessment process that starts on suspicion, not on confirmation. |
| Part IIIC | Eligible data breach assessment | Thirty days to assess, so the clock starts before you know the answer. |
| Part IIIC | Notification to the Commissioner and to individuals | A statement you can produce under pressure. |
Source. OAIC Australian Privacy Principles. Identifiers verified against the primary source, not quoted from a summary.
There is no certificate for the Privacy Act or for GDPR. The deliverable is a data map, a gap list against the principles above and a remediation plan. Legal interpretation belongs to your lawyer, and we will say so rather than guess.
It applies to most organisations over the turnover threshold and to some under it. The 2024 amendments raised penalties and expectations. Confirm with your legal adviser.
It can, if you offer goods or services to people in the European Union or monitor their behaviour. Where you are incorporated is not the test.
No. We do the engineering work: data mapping, access controls, retention, deletion and breach readiness. Your lawyer covers the legal position.
No. There is no certificate for GDPR or the Privacy Act. The output is a data map, a gap list and a remediation plan.
Privacy work overlaps the other regimes more than buyers expect. APP 11 covers much of the same ground as ISO 27001 readiness, and a customer asking for evidence usually wants SOC 2 readiness. Where personal information sits in a cloud account you cannot fully describe, a cloud security review is the faster way to find it, and our own trust centre shows the same questions answered about us.
Send the requester wording and your deadline. We will confirm scope and fee before any work starts.
Last reviewed: